CVE-2025-11577 Clevo UEFI firmware exposed Boot Guard private keys, enabling potential abuse of the Boot Guard trust chain
Attackers can sign malicious firmware using exposed private keys to bypass Boot Guard integrity checks on Clevo notebooks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-11577?
CVE-2025-11577 is a high-severity vulnerability in Clevo Notebook System Firmware, published on 14 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Clevo’s UEFI firmware update packages, including B10717.exe, inadvertently contained private signing keys used for Boot Guard and Boot Policy Manifest verification. The exposure of these keys could allow attackers to sign malicious firmware that appears trusted by affected systems, undermining the integrity of the early boot process.
Which versions are affected by CVE-2025-11577?
How do I fix CVE-2025-11577?
No fix has been published for CVE-2025-11577 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-11577 being exploited?
There is no known exploitation of CVE-2025-11577 in the wild and no public exploit code.
Sources
Also known as GHSA-pr99-8qv3-wr9x.